Preface: NVIDIA Dynamo-Triton and Triton inference server are functionally identical; NVIDIA Dynamo-Triton is simply the new name for the Triton inference server. NVIDIA has integrated Triton into its broader Dynamo platform and officially renamed it Dynamo-Triton. Thousands of enterprises and technology brands worldwide use NVIDIA Triton inference servers (now integrated into NVIDIA Dynamo-Triton) to run production-grade AI workloads. Key users include high-traffic consumer services, enterprise technology, and cloud service providers.

Background: The grpc_server[.]cc file implements the gRPC front-end server, and it interacts directly with the Triton Server C API to manage inference requests and responses.

How It Works?

•               The C API Location: The core logic of Triton is bundled into a core shared library (libtritonserver.so on Linux). This library exposes the main Triton Server C API via the tritonserver[.]h header file.

•               Role of grpc_server[.]cc: The tritonserver executable is essentially a wrapper. When a gRPC request arrives, grpc_server[.]cc captures the payload, converts it using C API calls like TRITONSERVER_InferenceRequestNew, and hands it to Triton’s core scheduler.

•               Handling Responses: Once the backend finishes executing the model, the C API triggers a callback mechanism back into grpc_server[.]cc. The file then serializes the data into a gRPC response proto and sends it back to the client.

Vulnerabilities details:

•               Target Environment: NVIDIA Triton Inference Server for Linux (Versions up to 26.05).

•               Core Problem: The model management service handles remote deployment requests (such as API model registration and configuration fetching) without verifying input path safety boundaries.

•               Exploit Vector: Attackers feed malicious strings through network frontends like gRPC payload parsing engines (grpc_server[.]cc) or HTTP gateways.

•               The Sequence: Flaws cascade systematically from an unvalidated metadata string → to folder structure escape → to unbounded host RAM allocation → to unauthenticated backend code execution (RCE).

Mitigation & Remediation: Upgrade to NVIDIA Triton Inference Server v26.06 or later to enforce strict input path validation boundaries.

Official announcement: Please refer to the link for details – https://nvidia.custhelp.com/app/answers/detail/a_id/5865